print header;
print start_html("Login");
...
print redirect("http//192.168.1.5/train/main.htm");
[download]

You can't use both redirect and output something else to the browser. If I understand what your code is doing, you probably want to wait with outputting the header and HTML until it's clear the user isn't being redirected.

I see a few more points in your code that could be improved:

• Declare variables for the smallest possible scope where they are needed, for example while( my ($id, $user, .... This will lead to less scoping issues; for example you've declared ($l,$a,$z) twice, which isn't necessary (and you should prefer my over our).
• Avoid the variable names $a or $b as they are special for sort.
• You don't need the foreach my $p (param()) loop since you're accessing the parameters directly by name.
• You don't need the $query = new CGI; since you're not using it anywhere; use either CGI.pm's object-oriented interface or its functional interface.
• You're doing the if($role eq $z) test twice; the second time it'll always be true.
• Instead of scanning the database yourself, look into SQL's WHERE clause and make sure to use placeholders, as documented in DBI.
• If train/main.htm doesn't do any authentication of its own, people will be able to easily circumvent this login form by entering the URL directly.
• See UP-TO-DATE Comparison of CGI Alternatives - personally I'd strongly recommend Mojolicious instead of CGI.pm; see Mojolicious::Guides::Tutorial, it's a very different and IMHO much nicer way to do web development. Update: I just posted an example.

Thank you haukex. I will look over my code and take a look at Mojolicious. Thank you again for your help.

Here's an implementation of a login system with Mojolicious::Lite and Mojo::SQLite. It may seem fairly long, but some of that code is because I added password encryption using PBKDF2::Tiny and Crypt::Random::Source (Update: and of course because it's entirely self-contained, it includes all the templates etc.). The security could even be expanded, such as adding brute force attack prevention (often done via a delay on unsuccessful attempts), or even hashing the password on the client side. Download the following code as e.g. mojo_login_example.pl, install the aforementioned modules, and then run the command: morbo --listen=http://127.0.0.1:3000 --listen=https://127.0.0.1:4430 mojo_login_example.pl

Walter_T:   To expand on the first point made by haukex, re-declaring a global (e.g., our) variable isn't just unnecessary, it's completely useless. The only thing it will do is to generate a warning message if warnings are enabled – which, IMHO, they should always be.

c:\@Work\Perl\monks>perl -le
"use strict;
 use warnings;
 ;;
 our $x = 'x before loop';
 print qq{before loop: '$x'};
 ;;
 for my $i (1 .. 2) {
   our $x = 'x in loop';
   print qq{in loop: iteration $i: '$x'};
   }
 ;;
 print qq{after loop: '$x'};
"
"our" variable $x redeclared at -e line 1.
        (Did you mean "local" instead of "our"?)
before loop: 'x before loop'
in loop: iteration 1: 'x in loop'
in loop: iteration 2: 'x in loop'
after loop: 'x in loop'
[download]

As the warning message suggests, you may have been thinking of local, which will actually do something in this situation.

c:\@Work\Perl\monks>perl -le
"use strict;
 use warnings;
 ;;
 our $x = 'x before loop';
 print qq{before loop: '$x'};
 ;;
 for my $i (1 .. 2) {
   local $x = 'x in loop';
   print qq{in loop: iteration $i: '$x'};
   }
 ;;
 print qq{after loop: '$x'};
"
before loop: 'x before loop'
in loop: iteration 1: 'x in loop'
in loop: iteration 2: 'x in loop'
after loop: 'x before loop'
[download]